CVE-2026-110916

CVSS: 9.6v3.1CriticalUndergoing analysis

AliasesDEBIAN-CVE-2026-110916

Published 15-10-2026Last modified 16-10-2026

Open JSON

Vulnerability summary

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.6/10

010

Critical · v3.1 (CVE.org)

EPSS score

0.21%

0%100%

Low · Change unavailable

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

15-10-2026
PublishedVulnerability first disclosed.
16-10-2026
Last modifiedVulnerability information updated.

Description

Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVSS metrics

2 scores · 2 sources · 1 version

v3.19.6

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

11%

Versus all other CVEs

30-day change

Change unavailable

16-10-202616-10-2026

EPSS score

0.21%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Debian1 product

chromiumAll versions (No fix recorded)

Google1 product

chrome≥ 155.0.8059.84, < 155.0.8059.84

2 vendors · 2 products

References

3 links